Skip to content
OpenAdvisories
Critical ICSA-25-175-05 3 CVEs

ControlID iDSecure On-premises

Published Jun 24, 2025 · Updated Jun 24, 2025

Vendor: Control iD Product: iDSecure On-premises

Summary

Successful exploitation of these vulnerabilities could allow an attacker to bypass authentication, retrieve information, leak arbitrary data, or perform SQL injections.

Vulnerabilities 3

  • Critical 9.1
    CVE-2025-49853

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') in ControlID iDSecure On-premises

    ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to SQL injections which could allow an attacker to leak arbitrary information and insert arbitrary SQL syntax into SQL queries.

    Control iD iDSecure On-premises
  • High 8.7
    CVE-2025-49851

    Improper Authentication in ControlID iDSecure On-premises

    ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to an improper authentication vulnerability which could allow an attacker to bypass authentication and gain permissions in the product.

    Control iD iDSecure On-premises
  • High 7.5
    CVE-2025-49852

    Server-Side Request Forgery (SSRF) in ControlID iDSecure On-premises

    ControlID iDSecure On-premises versions 4.7.48.0 and prior are vulnerable to a server-side request forgery vulnerability which could allow an unauthenticated attacker to retrieve information from other servers.

    Control iD iDSecure On-premises

Revision history

  1. #1

    Initial Publication

References